[PATCH] crypto: rsassa-pkcs1 - Use constant-time digest comparison

[Jiangshan Yi]

The digest comparison in rsassa_pkcs1_verify() uses memcmp(), whose
execution time depends on the position of the first mismatched byte.
This creates a timing side-channel that could allow an attacker to
forge RSA PKCS#1 v1.5 signatures byte by byte.

Notably, the same function already uses crypto_memneq() for the hash
prefix comparison (line 287), making the memcmp() at line 294 an
inconsistent oversight.

Replace memcmp() with crypto_memneq() to perform a constant-time
comparison, consistent with the rest of the function and the crypto
subsystem (gcm, ccm, chacha20poly1305, krb5enc, etc.).

Signed-off-by: Jiangshan Yi <yijiangshan@xxxxxxxxxx>
---
 crypto/rsassa-pkcs1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/rsassa-pkcs1.c b/crypto/rsassa-pkcs1.c
index 94fa5e9600e7..a612a9eef2dd 100644
--- a/crypto/rsassa-pkcs1.c
+++ b/crypto/rsassa-pkcs1.c
@@ -291,7 +291,7 @@ static int rsassa_pkcs1_verify(struct crypto_sig *tfm,
 	/* RFC 8017 sec 8.2.2 step 4 - comparison of digest with out_buf */
 	if (dlen != dst_len - pos)
 		return -EKEYREJECTED;
-	if (memcmp(digest, out_buf + pos, dlen) != 0)
+	if (crypto_memneq(digest, out_buf + pos, dlen))
 		return -EKEYREJECTED;
 
 	return 0;
-- 
2.25.1